IPSec VPN - not creating tunnel IP address in GNS3

[posemman]

Hi,

I have inquiry if do i need to manually input ip address on IPSec tunnel interface after establishing the IPSEC VPN thru fortigate?

Or it is automatically created?

Attached is the topology in GNS3.

[Toshi_Esumi]

In case of site-to-site VPNs, you need to manually configure a tunnel IP address on the tunnel interface if you want to use it for routing/protocol, etc. on both sides. Even if you create it via GUI wizard, it doesn't set the IP on the tunnel interface so you need to configure it afterword. The tunnel interface is the same as the phase1 name.

[posemman]

Both fortigate is now connected thru ipsec even w/o tunnel ip address.

Do I still need to set ip address on tunnel interface?

Scenario is, we have MPLS as a main connection on both offices and this connection use EIGRP routing protocol.

What we need is to create IPSEC VPN as a backup connection when MPLS is down.

What I do in this simulation is I create OSPF on core switch and Fortigate then redistribute EIGRP subnets on OSPF process.

Core switch config:

router ospf 1

 router-id 2.2.2.2

 log-adjacency-changes

 redistribute eigrp 27 subnets

 network 172.27.252.0 0.0.0.255 area 0

router eigrp 27

 network 172.27.252.0 0.0.0.255

 network 172.27.253.0 0.0.0.255

 network 172.27.7.0 0.0.0.255

 no auto-summary

Is the redistribution of routing to fortigate is correct? 

[Toshi_Esumi]

You don't have to if you don't need. That's why the wizard doesn't ask you to set the tunnel IP.

If you have multiple point-to-point neighboring and want to manipulate path per traffic it's easier to debug/troubleshoot when each tunnel interface has unique IP.